Sharepoint single sign-on with word

Question

We now have a sharepoint 2013 on-site solution that works just fine.

but we have an issue with opening word files from local word from outside of our domain. see why below:

Client on the local network, with domain machine: When the client tries to open a document from a library in sharepoint, it open in words and works as if it supposed to do.

Client on the external network, with a private machine (Not joined to the domain): the client goes to the webpage of the sharepoint and authenticate and then the client tries to open a document from a library in sharepoint, it open in words and then ask for password a couple of times, before it shows its content.

i want to avoid that, i want to have that i only need to authenticate 1 time (single sign-on) is it possible?

thanks in advanced

Answer 1

In short, no, it's not possible.

The client on the local network, with a domain joined machine is having their credentials automatically forwarded to the SharePoint server for both web access (using the local intranet site settings in IE) and for WebDAV (using the AuthForwardServerList settings in the registry), hence the reason that 'it just works' and the user is not prompted for credentials.

For the client on the external network, with a machine not on the domain, appropriate credentials are not available to the machine to forward on, hence the reason that the user is being prompted for credentials when accessing SharePoint originally, then again when opening a document. The second prompt is for the WebDAV protocol, which is used when opening documents from SharePoint 2013, which IIS regards as a new and separate session to the server, hence the requirement to re-authenticate.

Note that as long as the user leaves Word open between documents, the authentication for the session remains active with the server and they will not be prompted to authenticate again until they close Word, then attempt to open another document from SharePoint.

Following a comment, I've tested this using ADFS and WAP (using WAP as the reverse proxy) and in this scenario, the external user is still prompted for credentials on initial login to SharePoint, and then again by Word (it pops up a small window showing the ADFS login page) when a file is opened.